feat: settings password change, migrate desktop client with hub activation/report

app/db.py

@@ -101,6 +101,11 @@ def init_db() -> None:
                 open REAL, high REAL, low REAL, close REAL, volume REAL,
                 UNIQUE(symbol, timeframe, ts)
             );
+
+            CREATE TABLE IF NOT EXISTS settings (
+                key TEXT PRIMARY KEY,
+                value TEXT NOT NULL
+            );
             """
         )
 
@@ -259,7 +264,23 @@ def get_bars(conn: sqlite3.Connection, symbol: str, timeframe: str, start_ts: fl
     return [row_to_dict(r) for r in cur.fetchall()]
 
 
+def get_setting(conn: sqlite3.Connection, key: str, default: str = "") -> str:
+    row = conn.execute("SELECT value FROM settings WHERE key=?", (key,)).fetchone()
+    return row["value"] if row else default
+
+
+def set_setting(conn: sqlite3.Connection, key: str, value: str) -> None:
+    conn.execute(
+        "INSERT INTO settings(key, value) VALUES(?, ?) ON CONFLICT(key) DO UPDATE SET value=excluded.value",
+        (key, value),
+    )
+
+
 def seed_if_empty() -> None:
+    from werkzeug.security import generate_password_hash
+
+    from app.config import Config
+
     with get_db() as conn:
         n = conn.execute("SELECT COUNT(*) AS c FROM accounts").fetchone()["c"]
         if n == 0:
@@ -273,3 +294,44 @@ def seed_if_empty() -> None:
                 "INSERT INTO machines(name, device_fingerprint, note, enabled, created_at) VALUES(?,?,?,?,?)",
                 ("未绑定机器", "", "下载通用包后用激活码绑定", 1, now()),
             )
+        if not get_setting(conn, "admin_user"):
+            set_setting(conn, "admin_user", Config.ADMIN_USER)
+        if not get_setting(conn, "admin_password_hash"):
+            set_setting(
+                conn,
+                "admin_password_hash",
+                generate_password_hash(Config.ADMIN_PASSWORD),
+            )
+
+
+def verify_admin(username: str, password: str) -> bool:
+    from werkzeug.security import check_password_hash
+
+    with get_db() as conn:
+        user = get_setting(conn, "admin_user", "admin")
+        pwd_hash = get_setting(conn, "admin_password_hash")
+        if username != user:
+            return False
+        if not pwd_hash:
+            from app.config import Config
+
+            return password == Config.ADMIN_PASSWORD
+        return check_password_hash(pwd_hash, password)
+
+
+def change_admin_password(old_password: str, new_password: str) -> None:
+    from werkzeug.security import check_password_hash, generate_password_hash
+
+    if len(new_password) < 6:
+        raise ValueError("新密码至少 6 位")
+    with get_db() as conn:
+        pwd_hash = get_setting(conn, "admin_password_hash")
+        if pwd_hash:
+            if not check_password_hash(pwd_hash, old_password):
+                raise ValueError("当前密码不正确")
+        else:
+            from app.config import Config
+
+            if old_password != Config.ADMIN_PASSWORD:
+                raise ValueError("当前密码不正确")
+        set_setting(conn, "admin_password_hash", generate_password_hash(new_password))